Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 7, 2021, 9:42 a.m.	Nov. 7, 2021, 9:48 a.m.

Size	2.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d3d8953a702ac5187dc16e54c280074f`
SHA256	`d910274f59b79a0805bd9d7ea7c738311c057bac8d9b64fecf86b60143222c59`
CRC32	`6807748A`
ssdeep	`49152:/SSS8Y0d+rj//fVGqDPkkdUijzIZ4AA8A1iKQh/wz5p+QDWYYOu4:aOdUfVGqP5hIS/1izZwz5p`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file themida_packer - themida packer

200.exe "C:\Users\test22\AppData\Local\Temp\200.exe"
2772

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
109.234.39.186	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 7, 2021, 9:42 a.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 9:42 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2caf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2caf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a2c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 7, 2021, 9:42 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	\xe2\x82\xac\xc2\xae\xc2\xb0`
section	.themida
section	.boot

One or more processes crashed (17 events)

Time & API	Arguments	Status
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 200+0x3e587e @ 0x6b587e 200+0x40c737 @ 0x6dc737 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 4d 19 2a 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 2948648 registers.edi: 3538944 registers.eax: 2948648 registers.ebp: 2948728 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2003530795 registers.ecx: 1935736832	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: exception.instruction_r: ed e9 4f 82 0c 00 5c ae 0a 00 00 00 b8 f1 5b d2 exception.symbol: 200+0x3565da exception.instruction: in eax, dx exception.module: 200.exe exception.exception_code: 0xc0000096 exception.offset: 3499482 exception.address: 0x6265da registers.esp: 2948768 registers.edi: 5429405 registers.eax: 1750617430 registers.ebp: 3538944 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: exception.instruction_r: ed e9 4a 09 0a 00 c3 e9 fe dd 0b 00 09 00 b7 00 exception.symbol: 200+0x376ec3 exception.instruction: in eax, dx exception.module: 200.exe exception.exception_code: 0xc0000096 exception.offset: 3632835 exception.address: 0x646ec3 registers.esp: 2948768 registers.edi: 5429405 registers.eax: 1447909480 registers.ebp: 3538944 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x2a39afd 0x2a3999e 0x2a3518a 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a39bf0 registers.esp: 2945560 registers.edi: 50741408 registers.eax: 0 registers.ebp: 2945592 registers.edx: 10581920 registers.ebx: 50741304 registers.esi: 0 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x2a3d1c7 0x2a3d109 0x2a3cdf9 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945252 registers.edi: 52497668 registers.eax: 0 registers.ebp: 2945312 registers.edx: 92093900 registers.ebx: 0 registers.esi: 52497924 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x2a3d1c7 0x2a3d109 0x2a3cdf9 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945252 registers.edi: 53563564 registers.eax: 0 registers.ebp: 2945312 registers.edx: 92093900 registers.ebx: 0 registers.esi: 53563820 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x2a3d1c7 0x2a3d109 0x2a3cdf9 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945252 registers.edi: 50954228 registers.eax: 0 registers.ebp: 2945312 registers.edx: 92093900 registers.ebx: 0 registers.esi: 50954484 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x63200e6 0x2a3ff99 0x2a3ce9b 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945244 registers.edi: 51994360 registers.eax: 0 registers.ebp: 2945304 registers.edx: 92093900 registers.ebx: 0 registers.esi: 51994616 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x63200e6 0x2a3ff99 0x2a3ce9b 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945244 registers.edi: 53114616 registers.eax: 0 registers.ebp: 2945304 registers.edx: 92093900 registers.ebx: 0 registers.esi: 53114872 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x63200e6 0x2a3ff99 0x2a3ce9b 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945244 registers.edi: 50658672 registers.eax: 0 registers.ebp: 2945304 registers.edx: 92093900 registers.ebx: 0 registers.esi: 50658928 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x6320605 0x6320559 0x2a3cf28 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945248 registers.edi: 51779020 registers.eax: 0 registers.ebp: 2945308 registers.edx: 92093900 registers.ebx: 0 registers.esi: 51779276 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x6320605 0x6320559 0x2a3cf28 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945248 registers.edi: 52959128 registers.eax: 0 registers.ebp: 2945308 registers.edx: 92093900 registers.ebx: 0 registers.esi: 52959384 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x6320605 0x6320559 0x2a3cf28 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945248 registers.edi: 54139236 registers.eax: 0 registers.ebp: 2945308 registers.edx: 92093900 registers.ebx: 0 registers.esi: 54139492 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x63209f5 0x6320949 0x2a3cf99 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945248 registers.edi: 50538984 registers.eax: 0 registers.ebp: 2945308 registers.edx: 92093900 registers.ebx: 0 registers.esi: 50539240 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x63209f5 0x6320949 0x2a3cf99 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945248 registers.edi: 51721344 registers.eax: 0 registers.ebp: 2945308 registers.edx: 92093900 registers.ebx: 0 registers.esi: 51721600 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: 0x63209f5 0x6320949 0x2a3cf99 0x2a3c8b7 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c8 e9 fb 00 00 00 e8 00 51 3f 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2a3d635 registers.esp: 2945248 registers.edi: 52903704 registers.eax: 0 registers.ebp: 2945308 registers.edx: 92093900 registers.ebx: 0 registers.esi: 52903960 registers.ecx: 92099408	1
__exception__ Nov. 7, 2021, 9:42 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x36dd51 @ 0x721ddd51 mscorlib+0x32fea6 @ 0x7219fea6 mscorlib+0x30ab40 @ 0x7217ab40 0x2a3dbb4 0x632318f 0x6322d2e 0x6322764 0x2a39d94 0x2a3506d 0x2a34dc0 0x2a3005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 4d 19 2a 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 2945068 registers.edi: 0 registers.eax: 2945068 registers.ebp: 2945148 registers.edx: 0 registers.ebx: 102374024 registers.esi: 10581920 registers.ecx: 1998328581	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 247 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7670c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7670d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760db000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760db000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bf8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 9:42 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e7000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data

The binary likely contains encrypted or compressed data indicative of a packer (7 events)

section

{u'size_of_data': u'0x00019400', u'virtual_address': u'0x00002000', u'entropy': 7.973432983802359, u'name': u' ', u'virtual_size': u'0x00032000'}

entropy

7.9734329838

description